360 Degree Cyber Security, LLC

Tag Archive:industrial control security

Lost control of traffic control systems

March 24, 2018 – In this day and age, we mostly understand the requirement to protect information whether it is personal, or business related.  Positions related to information security can be found around the country typically in organizations larger than a small enterprise.  This included government organizations at all levels; federal, state, county, & municipal.

These organizations not only have the responsibility of protecting personally identifiable information of their citizens, but may also have additional standards/requirements they need to follow such as

  • PCI/DSS
  • HIPAA/HITECH
  • FERPA

If the organization is solely seeking to just meet the requirements, then they may be missing additional areas that need to be protected.  The Information Security Officer needs to transition to being a Security Officer responsible for securing all things digital, especially if they are critical for normal daily life.

Elements of critical infrastructure, such as the water supply and waste water have been in the news.  Some of the other services some municipalities provide and should be concerned with protecting are the transmission of electricity, Cable TV, and Internet services if they are services that they are responsible for providing.

As government agencies increasingly depend on devices that offer some advantage to remotely managing or gathering information from, more are being placed on the Internet.  One such device is the traffic controller.  These devices are found at individual intersections and can be linked together to improve traffic flow.

Traffic control systems are a form of an industrial control system.  They don’t operate at the speeds found in manufacturing systems, but they do operate in a similar manner.  They take inputs from road and optical sensors, adjust as programmed, and trigger events such as changing the lights from red to green.

So, what would happen if those control systems are left open to the world?  Well it could lead to scenes found in such movies as Live Free, Die Hard, or The Italian Job.  Recent research into traffic control systems led to the discovery of over 250 traffic control systems on the Internet in the United States and Canada.  Of those discovered, I was able to locate 25 in Canada and 24 in the United States that were open where the username and password were disabled.

Devices were found that controlled major intersections on a main thoroughfare where a highway intersected the road in two large cities.  Eleven out of 15 traffic control systems were found on a single major road through a city in California.  Several were discovered that belonged to a city in Texas.

What was concerning about the city in Texas, was that the city would not have known if those handful of devices were not open to the Internet.  Based on the IP address, there are assumptions that can be made about other IP addresses in the same address range that are protected by a login prompt.  This may represent all the traffic control systems in the city.

The traffic controls discovered are modular in nature.  Seeing that most of the Texas devices are protected with a username and password, it would seem those that are open to the Internet are that way probably due to maintenance where a module was replaced.

These findings were reported to the U.S. municipalities where these traffic control systems are located.  This was to allow them the opportunity to secure the system.  Hence the lack of specific details in this article.

Protecting traffic control systems from outside access is just as important as protecting all the information that the government organizations are responsible for protecting due to standards and regulation.  Traffic control systems are just as critical as water, sewage, and electricity and should be protected just the same.

Suggestions for organizations that manage traffic control systems:

  • Periodically scan Internet addresses of traffic control systems known to belong to the government organization to identify which ones are open.
  • Add traffic control systems to a security inventory, in addition to the standard information (model, serial number, etc.) annotate the IP address and port of any web portal the system has enabled.
  • Add traffic control systems to a change control process.
  • After any maintenance, remotely test connect to the device to ensure that login is required and that it is not the default login credentials

After all, who likes sitting in in traffic now?  Imaging what would happen if someone wanted to make it worse by remotely controlling the traffic control system from elsewhere in the world?

Incident Response – Not as simple as pulling the plug

Imagine this…  You are in charge of a major bank’s cyber security operations center.  It is 2:10AM and your cell phone is blowing up.  The network has been compromised.  The night time analyst has identified a worm and isolated it in……….  a system that controls the air conditioning at one of the branches.  A threat exists… Yes… But does not warrant taking down all of the banks networks.  It does indicate that extra vigilance and investigation are required.   The analyst performed all the steps as outlined in the incident response plan and mitigated the threat.

A well-defined and practiced incident response plan will provide the guidelines necessary to make a determination by the network administrator if the system/network should be shut down immediately or require remediation in place.

The response plan should take into consideration the criticality of the system, the value of the information, and the attack/threat characteristics.  Depending on the system/network’s purpose questions about the operation of the system need to be answered.  Questions such as:

•    Is the system critical to life/death/dismemberment?  Will physical damage result from an attack on the system?  What would happen if the device or network was disconnected or immediately shut down?
•    Does the device support critical infrastructure?  Will fail safe’s kick in if the system/network access is removed?
•    Is the device simply a database that contains personally identifiable information (PII) or electronic protected health information (ePHI)?
•    Is the network/device a mail server or web site server?

With the network/devices and criticalities identified, make a determination on the threat and how pervasive is it.

•    Is it a worm?
•    Is it a botnet?
•    Is information being ex-filtrated?
•    Are devices being remotely controlled preventing use?
•    What are the characteristics of the attack?

It is these types of questions that need to be answered and documented in an incident response plan.

A good example of an attack occurred late last year in Germany.  A steel mill in Germany was attacked that caused actual physical damage.  The attackers took control of a blast furnace and prevented an orderly shutdown of the furnace.  Technicians Utilized immediate emergency shutdown procedures over riding the control system at the furnace and prevented further damage (Zetter, 2015).  This example highlights that removing the system from the attack prevented subsequent damage.

However if the system is a critical system, like a power substation controller, and the attack vector appears to be a worm that is not immediately degrading the network or system, it may be beneficial leaving the system as is and attempting to mitigate the problem by migrating the responsibilities elsewhere.

A case can be made either way for shutting down the system/network immediately.  Factors such as attack impact and system criticality must be weighed.  A good response plan will take into account many such scenarios and will allow for improved decision making, coordination between internal and external entities, and a unified response which will ultimately result in the limitation of data.

References:
Zetter, K. (2015, January 8). A cyber attack has caused confirmed physical damage for the second time ever. Retrieved 2015, March 26 from http://www.wired.com/2015/01/german-steel-mill-hack-destruction/